KERNEL_SECURITY_CHECK_FAILURE: what it means and how to fix it

What KERNEL_SECURITY_CHECK_FAILURE means

Microsoft’s bug check reference says this stop code indicates that the kernel detected the corruption of a critical data structure. Windows checks certain structures as it uses them, and when one fails the check it halts rather than carry on with damaged data. The crash happens where the damage is found, which is often some time after the code that caused it ran. That’s why the blue screen may name a Windows file such as ntoskrnl.exe even when a third-party driver is to blame.

The first parameter on the blue screen or in the dump records what kind of check failed. You only need this if you open the dump, but it helps you read it:

Parameter 1	What Microsoft says it means
2	A stack buffer overrun was detected
3	A LIST_ENTRY (a linked list in kernel memory) is corrupted, for example removed twice
14	An object’s reference count is invalid
28	An out-of-bounds buffer access was detected

Microsoft’s page describes LIST_ENTRY corruption in detail and lists driver mistakes as the typical source, such as removing the same list entry twice or freeing memory that is still on a list. In practice that points you at drivers first, then memory and system files.

If Windows won’t stay up long enough

If the PC crashes again within minutes or loops on restart, work from Safe Mode, which loads only basic drivers. After two failed starts Windows usually opens the recovery environment on its own; see how to open WinRE if it doesn’t. Then choose Troubleshoot > Advanced options > Startup Settings, click Restart and press 4 or F4 for Safe Mode, or 5 / F5 for Safe Mode with Networking.

If the crashes stop in Safe Mode, that’s a strong sign a third-party driver or startup program is involved, not the hardware.

1. Undo what changed

Microsoft’s own first steps are to remove recently added hardware and to update or remove recently added drivers or services. Think back to when the crashes started:

• New hardware: shut down, remove it and test. This includes RAM, graphics cards, USB devices and docks.
• New software that installs a driver: antivirus, VPN clients, RGB lighting tools, game anti-cheat, virtual drive and backup tools. Uninstall it from Settings > Apps > Installed apps.
• A Windows update: go to Settings > Windows Update > Update history, then Uninstall updates under Related settings. If you can’t reach the desktop, WinRE has Troubleshoot > Advanced options > Uninstall Updates with an option to uninstall the latest quality update.
• Overclocking or undervolting: if you changed CPU, memory (XMP/EXPO) or GPU settings, put them back to default while you test.

2. Find the driver in the crash dump

By default Windows saves a small memory dump for each crash in %SystemRoot%\Minidump, which is C:\Windows\Minidump on most PCs. Checking it beats guessing, especially if the crashes are random.

1. Install WinDbg from the Microsoft Store.
2. Open WinDbg as administrator, choose File > Open dump file and pick the newest .dmp file.
3. In the command box, run:

!analyze -v

Look at MODULE_NAME and IMAGE_NAME near the end of the output. If it names a third-party driver (a .sys file from your graphics, network, audio, antivirus or VPN software), that’s your lead. If it only names Windows files like ntoskrnl.exe, open two or three dumps and compare; Microsoft suggests comparing several dumps because the real culprit may differ from the module that was running when the check failed. You can also check Event Viewer for errors logged just before each crash.

3. Update, roll back or remove the driver

Right-click Start and open Device Manager. Look for any device with a yellow warning mark first, as Microsoft recommends. For the driver you identified:

• Update it from the device or PC maker’s website. Graphics, chipset, storage and network drivers matter most here; Microsoft’s guidance also asks you to keep the BIOS and firmware up to date.
• Roll it back if the crashes started after a driver update: open the device’s Properties, go to the Driver tab and click Roll Back Driver.
• Uninstall the software that owns the driver if it’s an add-on such as antivirus or a VPN, then restart and test before reinstalling a current version.

Also install pending updates from Settings > Windows Update, since driver and kernel fixes ship there too.

4. Repair Windows files with DISM and SFC

Open Command Prompt as administrator and run these in order. Microsoft runs DISM first so SFC has a healthy image to repair from:

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

Restart when both finish. If SFC reports files it couldn’t fix, this guide to sfc /scannow results explains what to do next.

5. Test memory and check firmware

Faulty RAM can corrupt the same structures a bad driver does. Press Win + R, type mdsched and choose Restart now and check for problems (recommended). After Windows starts again, open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > MemoryDiagnostics-Results. According to Microsoft, event ID 2001 means no memory errors were found.

If you’ve added a memory stick recently, test with the old configuration or one stick at a time. While you’re checking hardware, update the BIOS/UEFI from the PC or motherboard maker if a newer version is available, and run a full malware scan; this guide covers the built-in options, including the offline scan.

6. Driver Verifier, carefully

Driver Verifier stresses drivers so a bad one crashes in a way that names it. Microsoft is clear that it can cause crashes and should only be run on computers used for testing and debugging, and that you shouldn’t verify all drivers at once. If you still want to try it on your own PC:

1. Create a restore point first.
2. In an elevated Command Prompt, run verifier to open Driver Verifier Manager and select a small group of non-Microsoft drivers, not all of them.
3. Use the PC normally. If it crashes, the new dump should name the driver.
4. Turn Driver Verifier off when you’re done, even if nothing happened:

verifier /reset

Restart afterwards. If Windows won’t boot with Driver Verifier on, start in Safe Mode and run verifier /reset there.

7. Restore or reset

If you can’t find the cause, use System Restore to go back to a point before the crashes began. Run rstrui.exe from the Run box, or in WinRE choose Troubleshoot > Advanced options > System Restore. It rolls back drivers, updates and settings without touching your personal files. Microsoft also says to keep 10 to 15 percent of the system drive free, so check space while you’re at it.

As a last resort, reset Windows or reinstall it; this reinstall guide compares the options. If the stop code returns on a clean install with no extra drivers, treat it as a hardware fault and test or swap RAM and storage.

Related guides

• WHEA_UNCORRECTABLE_ERROR (0x124): How to Fix It on Windows 11/10
• How to fix stop code 0x1000007E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED)
• WinRE: what the Windows Recovery Environment is and how to open it
• How to run sfc /scannow in Windows 11 and 10 (and read the results)

Official sources:

• Microsoft Learn: Bug Check 0x139 KERNEL_SECURITY_CHECK_FAILURE
• Microsoft Learn: Stop code error or bug check troubleshooting
• Microsoft Support: Troubleshooting unexpected restarts and stop code errors